add Gitea CI/CD workflows and Dockerfile

CI runs go vet/build/test plus govulncheck on PRs. Build pushes a
latest/previous image to the Gitea registry on push to main, and
Release pushes a tag-matched image on git tags. Adapted from the
project-manager workflows.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Dockerfile

@@ -0,0 +1,19 @@
+# Build stage: compile a static binary so the runtime image can be minimal.
+FROM golang:1.25-alpine AS build
+WORKDIR /src
+COPY go.mod go.sum ./
+RUN go mod download
+COPY . .
+RUN CGO_ENABLED=0 go build -trimpath -o /ultrashorty .
+
+# Runtime stage.
+FROM alpine:3.20
+RUN adduser -D -u 10001 ultrashorty
+USER ultrashorty
+COPY --from=build /ultrashorty /usr/local/bin/ultrashorty
+# The redirects CSV is supplied at deploy time (bind mount / config), and
+# --host must be set to 0.0.0.0 to accept connections from outside the
+# container -- ultrashorty defaults to localhost. Example:
+#   docker run -v ./redirects.csv:/redirects.csv <image> --host 0.0.0.0 /redirects.csv
+EXPOSE 4000
+ENTRYPOINT ["ultrashorty"]